# Access and keys

> Parklio has several ways to let someone other than you operate a product: a guest, an
> employee, your own app, a vehicle. They differ in who receives them, whether they work
> offline, whether Parklio emails anyone, and how fast you can revoke them. This page
> compares them so you can pick one.

## Where access comes from

When a product is paired with the Connect app, it gets a **master key**, a secret shared
by the product and Parklio. Every credential below is derived from it, and the product
checks them itself over Bluetooth, which is why some of them work without a network.
You never handle the master key. Pairing a product again, or removing it from its lot,
invalidates every credential derived from the old one.

## Comparison

| Mechanism | Who gets it | What they need | Reaches the product via | Works offline | Revocation | Parklio emails | Plan feature |
| --- | --- | --- | --- | --- | --- | --- | --- |
| **Operation token** | Your backend, which passes it to your app | Your app, built with the [Parklio SDK](/sdk) | The phone, over Bluetooth | ✅ | **Not immediate**: see below | No | — |
| **Operation key** | A Parklio Connect user, by email | The Connect app | The phone, over Bluetooth | ✅ | Block it through its key log | Only an invitation, when the email has no account yet | `KEY_SHARE` |
| **Key invitation** | An email address with no Parklio account | To sign up for the Connect app | Becomes an operation key on sign-up | — | Block it before it's accepted | Yes, the invitation | `KEY_SHARE` |
| **Weblink** | An email recipient | A browser | The cloud and a Gateway | ❌ | **Immediate** | Yes, always | — |
| **QR code** | Whoever holds the image | | | | **Can't be revoked** | No | `QR_CODE_SHARE` |
| **License plate** | A vehicle | Nothing | An LPR camera, the cloud and a Gateway | ❌ | Delete or expire the whitelist entry, or unbind the plate | No | — |

Two paths are built for integrations and have full guides:
[operation tokens](/guides/mobile-app-operation-tokens) for your own app, and
[license plates](/guides/plate-based-access) for vehicles. The others are covered by the
[API reference](/api).

## Operation tokens

For your own mobile app. Your backend creates a token for one product and a time window
with [`POST /v2/operation-tokens`](/api/endpoints/operation-tokens-create), and hands it
to your app, which uses the Parklio SDK to operate the product over Bluetooth.

- Give either an `end_time` or `"is_unlimited": true`. Unlimited tokens are valid until
  2038-01-01.
- The response contains three signed commands: `token_open`, `token_close` and
  `token_status`. Your app passes them to the product through the SDK.
- **Revocation isn't immediate.** Blocking a token
  ([`PATCH /v2/operation-tokens/{id}`](/api/endpoints/operation-tokens-update) with
  `{"status": "blocked"}`) marks it blocked on the server, but nothing is pushed to the
  device, so a copy your app already holds can keep working until `end_time`. **Create
  tokens just in time, with short windows.**
- The product's clock must be set (`rtcc_invalid` is `0`), or time-limited credentials
  fail.

See [SDK](/sdk).

## Operation keys and key invitations

For people who use the Parklio Connect app. Create one with
[`POST /v2/operation-keys`](/api/endpoints/operation-keys-create-many), naming the receiver
by email:

- If the email belongs to a Connect user, they get an **operation key** in their app.
- If not, Parklio emails them a **key invitation**. When they sign up for the Connect app
  with that email, it becomes an operation key.

To revoke an operation key, block its key log
([`PATCH /v2/key-logs/{id}`](/api/endpoints/key-logs-update)); Parklio emails the
receiver. Block a pending invitation with
[`PATCH /v2/key-invitations/{id}`](/api/endpoints/key-invitations-update).

## Weblinks

A link Parklio emails to the receiver; opening it in a browser lets them operate the
product through the cloud and a Gateway. Create one with
[`POST /v2/weblinks`](/api/endpoints/weblinks-bulk-create): `start_time` and `end_time` are
both required, and `max_uses` defaults to `1` (`null` for unlimited). Revocation is
immediate, because the server checks every use. Parklio always sends the email; you
can't send the link through your own channel.

## QR codes

An image that grants opening for a time window. Create one with
[`POST /v2/qr-codes`](/api/endpoints/qr-codes-create). **A QR code can't be revoked:**
deleting it only removes the record, so give it the shortest window that works.

## License plates

Vehicles whose plate is whitelisted on a lot can be let in by an LPR camera:

1. Whitelist the plate on the lot with
   [`POST /v2/lot-whitelists`](/api/endpoints/lot-whitelist-create), for a time window
   or unlimited.
2. Bind it to the products it should open with
   [`POST /v2/products/{id}/bind-licenses`](/api/endpoints/products-bind-license-for-product),
   using the `license_id` from step 1.
3. When a camera in the zone reads the plate on entry, Parklio opens a bound product
   that's online and closed, through a Gateway.

Each read is recorded as a [plate reading](/api/endpoints/plate-readings-find-all), with
an `access_decision` (`triggered` or `denied`) and the reason.

See [Plate-based access](/guides/plate-based-access).

## Next

- [Operation tokens for your app](/guides/mobile-app-operation-tokens)
- [Plate-based access](/guides/plate-based-access)
- [SDK](/sdk): the operation-token flow end to end.
- [Plans and permissions](/concepts/plans-and-permissions): the features each mechanism
  needs.